CVE-2021-22982 Memory corruption in BIG-IP DNS and GTM
A buffer overflow in big3d allows attackers to execute arbitrary code or cause denial of service on BIG-IP DNS and GTM systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22982?
CVE-2021-22982 is a high-severity memory corruption vulnerability in F5 Big-Ip Domain Name System, published on 12 Feb 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certain payloads resulting in a buffer overflow. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Weakness: CWE-120
Which versions are affected by CVE-2021-22982?
It affects 2 products.
Products include F5 Big-Ip Domain Name System, F5 Big-Ip Global Traffic Manager.
How do I fix CVE-2021-22982?
No fix has been published for CVE-2021-22982 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-22982 being exploited?
There is no known exploitation of CVE-2021-22982 in the wild and no public exploit code.
Other vulnerabilities in F5 Big-Ip Domain Name System
Sources
Also known as GHSA-3g9m-2rxr-22r8.